1/*
2 *  USB HID support for Linux
3 *
4 *  Copyright (c) 1999 Andreas Gal
5 *  Copyright (c) 2000-2005 Vojtech Pavlik <vojtech@suse.cz>
6 *  Copyright (c) 2005 Michael Haboustak <mike-@cinci.rr.com> for Concept2, Inc
7 *  Copyright (c) 2006-2007 Jiri Kosina
8 */
9
10/*
11 * This program is free software; you can redistribute it and/or modify it
12 * under the terms of the GNU General Public License as published by the Free
13 * Software Foundation; either version 2 of the License, or (at your option)
14 * any later version.
15 */
16
17#include <linux/module.h>
18#include <linux/slab.h>
19#include <linux/init.h>
20#include <linux/kernel.h>
21#include <linux/list.h>
22#include <linux/mm.h>
23#include <linux/smp_lock.h>
24#include <linux/spinlock.h>
25#include <asm/unaligned.h>
26#include <asm/byteorder.h>
27#include <linux/input.h>
28#include <linux/wait.h>
29
30#include <linux/usb.h>
31
32#include <linux/hid.h>
33#include <linux/hiddev.h>
34#include <linux/hid-debug.h>
35#include "usbhid.h"
36
37/*
38 * Version Information
39 */
40
41#define DRIVER_VERSION "v2.6"
42#define DRIVER_AUTHOR "Andreas Gal, Vojtech Pavlik, Jiri Kosina"
43#define DRIVER_DESC "USB HID core driver"
44#define DRIVER_LICENSE "GPL"
45
46static char *hid_types[] = {"Device", "Pointer", "Mouse", "Device", "Joystick",
47				"Gamepad", "Keyboard", "Keypad", "Multi-Axis Controller"};
48/*
49 * Module parameters.
50 */
51
52static unsigned int hid_mousepoll_interval;
53module_param_named(mousepoll, hid_mousepoll_interval, uint, 0644);
54MODULE_PARM_DESC(mousepoll, "Polling interval of mice");
55
56/* Quirks specified at module load time */
57static char *quirks_param[MAX_USBHID_BOOT_QUIRKS] = { [ 0 ... (MAX_USBHID_BOOT_QUIRKS - 1) ] = NULL };
58module_param_array_named(quirks, quirks_param, charp, NULL, 0444);
59MODULE_PARM_DESC(quirks, "Add/modify USB HID quirks by specifying "
60		" quirks=vendorID:productID:quirks"
61		" where vendorID, productID, and quirks are all in"
62		" 0x-prefixed hex");
63/*
64 * Input submission and I/O error handler.
65 */
66
67static void hid_io_error(struct hid_device *hid);
68
69/* Start up the input URB */
70static int hid_start_in(struct hid_device *hid)
71{
72	unsigned long flags;
73	int rc = 0;
74	struct usbhid_device *usbhid = hid->driver_data;
75
76	spin_lock_irqsave(&usbhid->inlock, flags);
77	if (hid->open > 0 && !test_bit(HID_SUSPENDED, &usbhid->iofl) &&
78			!test_and_set_bit(HID_IN_RUNNING, &usbhid->iofl)) {
79		rc = usb_submit_urb(usbhid->urbin, GFP_ATOMIC);
80		if (rc != 0)
81			clear_bit(HID_IN_RUNNING, &usbhid->iofl);
82	}
83	spin_unlock_irqrestore(&usbhid->inlock, flags);
84	return rc;
85}
86
87/* I/O retry timer routine */
88static void hid_retry_timeout(unsigned long _hid)
89{
90	struct hid_device *hid = (struct hid_device *) _hid;
91	struct usbhid_device *usbhid = hid->driver_data;
92
93	dev_dbg(&usbhid->intf->dev, "retrying intr urb\n");
94	if (hid_start_in(hid))
95		hid_io_error(hid);
96}
97
98/* Workqueue routine to reset the device or clear a halt */
99static void hid_reset(struct work_struct *work)
100{
101	struct usbhid_device *usbhid =
102		container_of(work, struct usbhid_device, reset_work);
103	struct hid_device *hid = usbhid->hid;
104	int rc_lock, rc = 0;
105
106	if (test_bit(HID_CLEAR_HALT, &usbhid->iofl)) {
107		dev_dbg(&usbhid->intf->dev, "clear halt\n");
108		rc = usb_clear_halt(hid_to_usb_dev(hid), usbhid->urbin->pipe);
109		clear_bit(HID_CLEAR_HALT, &usbhid->iofl);
110		hid_start_in(hid);
111	}
112
113	else if (test_bit(HID_RESET_PENDING, &usbhid->iofl)) {
114		dev_dbg(&usbhid->intf->dev, "resetting device\n");
115		rc = rc_lock = usb_lock_device_for_reset(hid_to_usb_dev(hid), usbhid->intf);
116		if (rc_lock >= 0) {
117			rc = usb_reset_composite_device(hid_to_usb_dev(hid), usbhid->intf);
118			if (rc_lock)
119				usb_unlock_device(hid_to_usb_dev(hid));
120		}
121		clear_bit(HID_RESET_PENDING, &usbhid->iofl);
122	}
123
124	switch (rc) {
125	case 0:
126		if (!test_bit(HID_IN_RUNNING, &usbhid->iofl))
127			hid_io_error(hid);
128		break;
129	default:
130		err("can't reset device, %s-%s/input%d, status %d",
131				hid_to_usb_dev(hid)->bus->bus_name,
132				hid_to_usb_dev(hid)->devpath,
133				usbhid->ifnum, rc);
134		/* FALLTHROUGH */
135	case -EHOSTUNREACH:
136	case -ENODEV:
137	case -EINTR:
138		break;
139	}
140}
141
142/* Main I/O error handler */
143static void hid_io_error(struct hid_device *hid)
144{
145	unsigned long flags;
146	struct usbhid_device *usbhid = hid->driver_data;
147
148	spin_lock_irqsave(&usbhid->inlock, flags);
149
150	/* Stop when disconnected */
151	if (usb_get_intfdata(usbhid->intf) == NULL)
152		goto done;
153
154	/* If it has been a while since the last error, we'll assume
155	 * this a brand new error and reset the retry timeout. */
156	if (time_after(jiffies, usbhid->stop_retry + HZ/2))
157		usbhid->retry_delay = 0;
158
159	/* When an error occurs, retry at increasing intervals */
160	if (usbhid->retry_delay == 0) {
161		usbhid->retry_delay = 13;	/* Then 26, 52, 104, 104, ... */
162		usbhid->stop_retry = jiffies + msecs_to_jiffies(1000);
163	} else if (usbhid->retry_delay < 100)
164		usbhid->retry_delay *= 2;
165
166	if (time_after(jiffies, usbhid->stop_retry)) {
167
168		/* Retries failed, so do a port reset */
169		if (!test_and_set_bit(HID_RESET_PENDING, &usbhid->iofl)) {
170			schedule_work(&usbhid->reset_work);
171			goto done;
172		}
173	}
174
175	mod_timer(&usbhid->io_retry,
176			jiffies + msecs_to_jiffies(usbhid->retry_delay));
177done:
178	spin_unlock_irqrestore(&usbhid->inlock, flags);
179}
180
181/*
182 * Input interrupt completion handler.
183 */
184
185static void hid_irq_in(struct urb *urb)
186{
187	struct hid_device	*hid = urb->context;
188	struct usbhid_device 	*usbhid = hid->driver_data;
189	int			status;
190
191	switch (urb->status) {
192		case 0:			/* success */
193			usbhid->retry_delay = 0;
194			hid_input_report(urb->context, HID_INPUT_REPORT,
195					 urb->transfer_buffer,
196					 urb->actual_length, 1);
197			break;
198		case -EPIPE:		/* stall */
199			clear_bit(HID_IN_RUNNING, &usbhid->iofl);
200			set_bit(HID_CLEAR_HALT, &usbhid->iofl);
201			schedule_work(&usbhid->reset_work);
202			return;
203		case -ECONNRESET:	/* unlink */
204		case -ENOENT:
205		case -ESHUTDOWN:	/* unplug */
206			clear_bit(HID_IN_RUNNING, &usbhid->iofl);
207			return;
208		case -EILSEQ:		/* protocol error or unplug */
209		case -EPROTO:		/* protocol error or unplug */
210		case -ETIME:		/* protocol error or unplug */
211		case -ETIMEDOUT:	/* Should never happen, but... */
212			clear_bit(HID_IN_RUNNING, &usbhid->iofl);
213			hid_io_error(hid);
214			return;
215		default:		/* error */
216			warn("input irq status %d received", urb->status);
217	}
218
219	status = usb_submit_urb(urb, GFP_ATOMIC);
220	if (status) {
221		clear_bit(HID_IN_RUNNING, &usbhid->iofl);
222		if (status != -EPERM) {
223			err("can't resubmit intr, %s-%s/input%d, status %d",
224					hid_to_usb_dev(hid)->bus->bus_name,
225					hid_to_usb_dev(hid)->devpath,
226					usbhid->ifnum, status);
227			hid_io_error(hid);
228		}
229	}
230}
231
232static int hid_submit_out(struct hid_device *hid)
233{
234	struct hid_report *report;
235	struct usbhid_device *usbhid = hid->driver_data;
236
237	report = usbhid->out[usbhid->outtail];
238
239	hid_output_report(report, usbhid->outbuf);
240	usbhid->urbout->transfer_buffer_length = ((report->size - 1) >> 3) + 1 + (report->id > 0);
241	usbhid->urbout->dev = hid_to_usb_dev(hid);
242
243	dbg("submitting out urb");
244
245	if (usb_submit_urb(usbhid->urbout, GFP_ATOMIC)) {
246		err("usb_submit_urb(out) failed");
247		return -1;
248	}
249
250	return 0;
251}
252
253static int hid_submit_ctrl(struct hid_device *hid)
254{
255	struct hid_report *report;
256	unsigned char dir;
257	int len;
258	struct usbhid_device *usbhid = hid->driver_data;
259
260	report = usbhid->ctrl[usbhid->ctrltail].report;
261	dir = usbhid->ctrl[usbhid->ctrltail].dir;
262
263	len = ((report->size - 1) >> 3) + 1 + (report->id > 0);
264	if (dir == USB_DIR_OUT) {
265		hid_output_report(report, usbhid->ctrlbuf);
266		usbhid->urbctrl->pipe = usb_sndctrlpipe(hid_to_usb_dev(hid), 0);
267		usbhid->urbctrl->transfer_buffer_length = len;
268	} else {
269		int maxpacket, padlen;
270
271		usbhid->urbctrl->pipe = usb_rcvctrlpipe(hid_to_usb_dev(hid), 0);
272		maxpacket = usb_maxpacket(hid_to_usb_dev(hid), usbhid->urbctrl->pipe, 0);
273		if (maxpacket > 0) {
274			padlen = (len + maxpacket - 1) / maxpacket;
275			padlen *= maxpacket;
276			if (padlen > usbhid->bufsize)
277				padlen = usbhid->bufsize;
278		} else
279			padlen = 0;
280		usbhid->urbctrl->transfer_buffer_length = padlen;
281	}
282	usbhid->urbctrl->dev = hid_to_usb_dev(hid);
283
284	usbhid->cr->bRequestType = USB_TYPE_CLASS | USB_RECIP_INTERFACE | dir;
285	usbhid->cr->bRequest = (dir == USB_DIR_OUT) ? HID_REQ_SET_REPORT : HID_REQ_GET_REPORT;
286	usbhid->cr->wValue = cpu_to_le16(((report->type + 1) << 8) | report->id);
287	usbhid->cr->wIndex = cpu_to_le16(usbhid->ifnum);
288	usbhid->cr->wLength = cpu_to_le16(len);
289
290	dbg("submitting ctrl urb: %s wValue=0x%04x wIndex=0x%04x wLength=%u",
291		usbhid->cr->bRequest == HID_REQ_SET_REPORT ? "Set_Report" : "Get_Report",
292		usbhid->cr->wValue, usbhid->cr->wIndex, usbhid->cr->wLength);
293
294	if (usb_submit_urb(usbhid->urbctrl, GFP_ATOMIC)) {
295		err("usb_submit_urb(ctrl) failed");
296		return -1;
297	}
298
299	return 0;
300}
301
302/*
303 * Output interrupt completion handler.
304 */
305
306static void hid_irq_out(struct urb *urb)
307{
308	struct hid_device *hid = urb->context;
309	struct usbhid_device *usbhid = hid->driver_data;
310	unsigned long flags;
311	int unplug = 0;
312
313	switch (urb->status) {
314		case 0:			/* success */
315			break;
316		case -ESHUTDOWN:	/* unplug */
317			unplug = 1;
318		case -EILSEQ:		/* protocol error or unplug */
319		case -EPROTO:		/* protocol error or unplug */
320		case -ECONNRESET:	/* unlink */
321		case -ENOENT:
322			break;
323		default:		/* error */
324			warn("output irq status %d received", urb->status);
325	}
326
327	spin_lock_irqsave(&usbhid->outlock, flags);
328
329	if (unplug)
330		usbhid->outtail = usbhid->outhead;
331	else
332		usbhid->outtail = (usbhid->outtail + 1) & (HID_OUTPUT_FIFO_SIZE - 1);
333
334	if (usbhid->outhead != usbhid->outtail) {
335		if (hid_submit_out(hid)) {
336			clear_bit(HID_OUT_RUNNING, &usbhid->iofl);
337			wake_up(&hid->wait);
338		}
339		spin_unlock_irqrestore(&usbhid->outlock, flags);
340		return;
341	}
342
343	clear_bit(HID_OUT_RUNNING, &usbhid->iofl);
344	spin_unlock_irqrestore(&usbhid->outlock, flags);
345	wake_up(&hid->wait);
346}
347
348/*
349 * Control pipe completion handler.
350 */
351
352static void hid_ctrl(struct urb *urb)
353{
354	struct hid_device *hid = urb->context;
355	struct usbhid_device *usbhid = hid->driver_data;
356	unsigned long flags;
357	int unplug = 0;
358
359	spin_lock_irqsave(&usbhid->ctrllock, flags);
360
361	switch (urb->status) {
362		case 0:			/* success */
363			if (usbhid->ctrl[usbhid->ctrltail].dir == USB_DIR_IN)
364				hid_input_report(urb->context, usbhid->ctrl[usbhid->ctrltail].report->type,
365						urb->transfer_buffer, urb->actual_length, 0);
366			break;
367		case -ESHUTDOWN:	/* unplug */
368			unplug = 1;
369		case -EILSEQ:		/* protocol error or unplug */
370		case -EPROTO:		/* protocol error or unplug */
371		case -ECONNRESET:	/* unlink */
372		case -ENOENT:
373		case -EPIPE:		/* report not available */
374			break;
375		default:		/* error */
376			warn("ctrl urb status %d received", urb->status);
377	}
378
379	if (unplug)
380		usbhid->ctrltail = usbhid->ctrlhead;
381	else
382		usbhid->ctrltail = (usbhid->ctrltail + 1) & (HID_CONTROL_FIFO_SIZE - 1);
383
384	if (usbhid->ctrlhead != usbhid->ctrltail) {
385		if (hid_submit_ctrl(hid)) {
386			clear_bit(HID_CTRL_RUNNING, &usbhid->iofl);
387			wake_up(&hid->wait);
388		}
389		spin_unlock_irqrestore(&usbhid->ctrllock, flags);
390		return;
391	}
392
393	clear_bit(HID_CTRL_RUNNING, &usbhid->iofl);
394	spin_unlock_irqrestore(&usbhid->ctrllock, flags);
395	wake_up(&hid->wait);
396}
397
398void usbhid_submit_report(struct hid_device *hid, struct hid_report *report, unsigned char dir)
399{
400	int head;
401	unsigned long flags;
402	struct usbhid_device *usbhid = hid->driver_data;
403
404	if ((hid->quirks & HID_QUIRK_NOGET) && dir == USB_DIR_IN)
405		return;
406
407	if (usbhid->urbout && dir == USB_DIR_OUT && report->type == HID_OUTPUT_REPORT) {
408
409		spin_lock_irqsave(&usbhid->outlock, flags);
410
411		if ((head = (usbhid->outhead + 1) & (HID_OUTPUT_FIFO_SIZE - 1)) == usbhid->outtail) {
412			spin_unlock_irqrestore(&usbhid->outlock, flags);
413			warn("output queue full");
414			return;
415		}
416
417		usbhid->out[usbhid->outhead] = report;
418		usbhid->outhead = head;
419
420		if (!test_and_set_bit(HID_OUT_RUNNING, &usbhid->iofl))
421			if (hid_submit_out(hid))
422				clear_bit(HID_OUT_RUNNING, &usbhid->iofl);
423
424		spin_unlock_irqrestore(&usbhid->outlock, flags);
425		return;
426	}
427
428	spin_lock_irqsave(&usbhid->ctrllock, flags);
429
430	if ((head = (usbhid->ctrlhead + 1) & (HID_CONTROL_FIFO_SIZE - 1)) == usbhid->ctrltail) {
431		spin_unlock_irqrestore(&usbhid->ctrllock, flags);
432		warn("control queue full");
433		return;
434	}
435
436	usbhid->ctrl[usbhid->ctrlhead].report = report;
437	usbhid->ctrl[usbhid->ctrlhead].dir = dir;
438	usbhid->ctrlhead = head;
439
440	if (!test_and_set_bit(HID_CTRL_RUNNING, &usbhid->iofl))
441		if (hid_submit_ctrl(hid))
442			clear_bit(HID_CTRL_RUNNING, &usbhid->iofl);
443
444	spin_unlock_irqrestore(&usbhid->ctrllock, flags);
445}
446
447static int usb_hidinput_input_event(struct input_dev *dev, unsigned int type, unsigned int code, int value)
448{
449	struct hid_device *hid = input_get_drvdata(dev);
450	struct hid_field *field;
451	int offset;
452
453	if (type == EV_FF)
454		return input_ff_event(dev, type, code, value);
455
456	if (type != EV_LED)
457		return -1;
458
459	if ((offset = hidinput_find_field(hid, type, code, &field)) == -1) {
460		warn("event field not found");
461		return -1;
462	}
463
464	hid_set_field(field, offset, value);
465	usbhid_submit_report(hid, field->report, USB_DIR_OUT);
466
467	return 0;
468}
469
470int usbhid_wait_io(struct hid_device *hid)
471{
472	struct usbhid_device *usbhid = hid->driver_data;
473
474	if (!wait_event_timeout(hid->wait, (!test_bit(HID_CTRL_RUNNING, &usbhid->iofl) &&
475					!test_bit(HID_OUT_RUNNING, &usbhid->iofl)),
476					10*HZ)) {
477		dbg("timeout waiting for ctrl or out queue to clear");
478		return -1;
479	}
480
481	return 0;
482}
483
484static int hid_set_idle(struct usb_device *dev, int ifnum, int report, int idle)
485{
486	return usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
487		HID_REQ_SET_IDLE, USB_TYPE_CLASS | USB_RECIP_INTERFACE, (idle << 8) | report,
488		ifnum, NULL, 0, USB_CTRL_SET_TIMEOUT);
489}
490
491static int hid_get_class_descriptor(struct usb_device *dev, int ifnum,
492		unsigned char type, void *buf, int size)
493{
494	int result, retries = 4;
495
496	memset(buf, 0, size);
497
498	do {
499		result = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0),
500				USB_REQ_GET_DESCRIPTOR, USB_RECIP_INTERFACE | USB_DIR_IN,
501				(type << 8), ifnum, buf, size, USB_CTRL_GET_TIMEOUT);
502		retries--;
503	} while (result < size && retries);
504	return result;
505}
506
507int usbhid_open(struct hid_device *hid)
508{
509	++hid->open;
510	if (hid_start_in(hid))
511		hid_io_error(hid);
512	return 0;
513}
514
515void usbhid_close(struct hid_device *hid)
516{
517	struct usbhid_device *usbhid = hid->driver_data;
518
519	if (!--hid->open)
520		usb_kill_urb(usbhid->urbin);
521}
522
523/*
524 * Initialize all reports
525 */
526
527void usbhid_init_reports(struct hid_device *hid)
528{
529	struct hid_report *report;
530	struct usbhid_device *usbhid = hid->driver_data;
531	int err, ret;
532
533	list_for_each_entry(report, &hid->report_enum[HID_INPUT_REPORT].report_list, list)
534		usbhid_submit_report(hid, report, USB_DIR_IN);
535
536	list_for_each_entry(report, &hid->report_enum[HID_FEATURE_REPORT].report_list, list)
537		usbhid_submit_report(hid, report, USB_DIR_IN);
538
539	err = 0;
540	ret = usbhid_wait_io(hid);
541	while (ret) {
542		err |= ret;
543		if (test_bit(HID_CTRL_RUNNING, &usbhid->iofl))
544			usb_kill_urb(usbhid->urbctrl);
545		if (test_bit(HID_OUT_RUNNING, &usbhid->iofl))
546			usb_kill_urb(usbhid->urbout);
547		ret = usbhid_wait_io(hid);
548	}
549
550	if (err)
551		warn("timeout initializing reports");
552}
553
554/*
555 * Reset LEDs which BIOS might have left on. For now, just NumLock (0x01).
556 */
557static int hid_find_field_early(struct hid_device *hid, unsigned int page,
558    unsigned int hid_code, struct hid_field **pfield)
559{
560	struct hid_report *report;
561	struct hid_field *field;
562	struct hid_usage *usage;
563	int i, j;
564
565	list_for_each_entry(report, &hid->report_enum[HID_OUTPUT_REPORT].report_list, list) {
566		for (i = 0; i < report->maxfield; i++) {
567			field = report->field[i];
568			for (j = 0; j < field->maxusage; j++) {
569				usage = &field->usage[j];
570				if ((usage->hid & HID_USAGE_PAGE) == page &&
571				    (usage->hid & 0xFFFF) == hid_code) {
572					*pfield = field;
573					return j;
574				}
575			}
576		}
577	}
578	return -1;
579}
580
581static void usbhid_set_leds(struct hid_device *hid)
582{
583	struct hid_field *field;
584	int offset;
585
586	if ((offset = hid_find_field_early(hid, HID_UP_LED, 0x01, &field)) != -1) {
587		hid_set_field(field, offset, 0);
588		usbhid_submit_report(hid, field->report, USB_DIR_OUT);
589	}
590}
591
592/*
593 * Traverse the supplied list of reports and find the longest
594 */
595static void hid_find_max_report(struct hid_device *hid, unsigned int type, int *max)
596{
597	struct hid_report *report;
598	int size;
599
600	list_for_each_entry(report, &hid->report_enum[type].report_list, list) {
601		size = ((report->size - 1) >> 3) + 1;
602		if (type == HID_INPUT_REPORT && hid->report_enum[type].numbered)
603			size++;
604		if (*max < size)
605			*max = size;
606	}
607}
608
609static int hid_alloc_buffers(struct usb_device *dev, struct hid_device *hid)
610{
611	struct usbhid_device *usbhid = hid->driver_data;
612
613	if (!(usbhid->inbuf = usb_buffer_alloc(dev, usbhid->bufsize, GFP_ATOMIC, &usbhid->inbuf_dma)))
614		return -1;
615	if (!(usbhid->outbuf = usb_buffer_alloc(dev, usbhid->bufsize, GFP_ATOMIC, &usbhid->outbuf_dma)))
616		return -1;
617	if (!(usbhid->cr = usb_buffer_alloc(dev, sizeof(*(usbhid->cr)), GFP_ATOMIC, &usbhid->cr_dma)))
618		return -1;
619	if (!(usbhid->ctrlbuf = usb_buffer_alloc(dev, usbhid->bufsize, GFP_ATOMIC, &usbhid->ctrlbuf_dma)))
620		return -1;
621
622	return 0;
623}
624
625static void hid_free_buffers(struct usb_device *dev, struct hid_device *hid)
626{
627	struct usbhid_device *usbhid = hid->driver_data;
628
629	usb_buffer_free(dev, usbhid->bufsize, usbhid->inbuf, usbhid->inbuf_dma);
630	usb_buffer_free(dev, usbhid->bufsize, usbhid->outbuf, usbhid->outbuf_dma);
631	usb_buffer_free(dev, sizeof(*(usbhid->cr)), usbhid->cr, usbhid->cr_dma);
632	usb_buffer_free(dev, usbhid->bufsize, usbhid->ctrlbuf, usbhid->ctrlbuf_dma);
633}
634
635/*
636 * Cherry Cymotion keyboard have an invalid HID report descriptor,
637 * that needs fixing before we can parse it.
638 */
639
640static void hid_fixup_cymotion_descriptor(char *rdesc, int rsize)
641{
642	if (rsize >= 17 && rdesc[11] == 0x3c && rdesc[12] == 0x02) {
643		info("Fixing up Cherry Cymotion report descriptor");
644		rdesc[11] = rdesc[16] = 0xff;
645		rdesc[12] = rdesc[17] = 0x03;
646	}
647}
648
649/*
650 * Sending HID_REQ_GET_REPORT changes the operation mode of the ps3 controller
651 * to "operational".  Without this, the ps3 controller will not report any
652 * events.
653 */
654static void hid_fixup_sony_ps3_controller(struct usb_device *dev, int ifnum)
655{
656	int result;
657	char *buf = kmalloc(18, GFP_KERNEL);
658
659	if (!buf)
660		return;
661
662	result = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0),
663				 HID_REQ_GET_REPORT,
664				 USB_DIR_IN | USB_TYPE_CLASS |
665				 USB_RECIP_INTERFACE,
666				 (3 << 8) | 0xf2, ifnum, buf, 17,
667				 USB_CTRL_GET_TIMEOUT);
668
669	if (result < 0)
670		err("%s failed: %d\n", __func__, result);
671
672	kfree(buf);
673}
674
675/*
676 * Certain Logitech keyboards send in report #3 keys which are far
677 * above the logical maximum described in descriptor. This extends
678 * the original value of 0x28c of logical maximum to 0x104d
679 */
680static void hid_fixup_logitech_descriptor(unsigned char *rdesc, int rsize)
681{
682	if (rsize >= 90 && rdesc[83] == 0x26
683			&& rdesc[84] == 0x8c
684			&& rdesc[85] == 0x02) {
685		info("Fixing up Logitech keyboard report descriptor");
686		rdesc[84] = rdesc[89] = 0x4d;
687		rdesc[85] = rdesc[90] = 0x10;
688	}
689}
690
691/*
692 * Some USB barcode readers from cypress have usage min and usage max in
693 * the wrong order
694 */
695static void hid_fixup_cypress_descriptor(unsigned char *rdesc, int rsize)
696{
697	short fixed = 0;
698	int i;
699
700	for (i = 0; i < rsize - 4; i++) {
701		if (rdesc[i] == 0x29 && rdesc [i+2] == 0x19) {
702			unsigned char tmp;
703
704			rdesc[i] = 0x19; rdesc[i+2] = 0x29;
705			tmp = rdesc[i+3];
706			rdesc[i+3] = rdesc[i+1];
707			rdesc[i+1] = tmp;
708		}
709	}
710
711	if (fixed)
712		info("Fixing up Cypress report descriptor");
713}
714
715static struct hid_device *usb_hid_configure(struct usb_interface *intf)
716{
717	struct usb_host_interface *interface = intf->cur_altsetting;
718	struct usb_device *dev = interface_to_usbdev (intf);
719	struct hid_descriptor *hdesc;
720	struct hid_device *hid;
721	u32 quirks = 0;
722	unsigned rsize = 0;
723	char *rdesc;
724	int n, len, insize = 0;
725	struct usbhid_device *usbhid;
726
727	quirks = usbhid_lookup_quirk(le16_to_cpu(dev->descriptor.idVendor),
728			le16_to_cpu(dev->descriptor.idProduct));
729
730	/* Many keyboards and mice don't like to be polled for reports,
731	 * so we will always set the HID_QUIRK_NOGET flag for them. */
732	if (interface->desc.bInterfaceSubClass == USB_INTERFACE_SUBCLASS_BOOT) {
733		if (interface->desc.bInterfaceProtocol == USB_INTERFACE_PROTOCOL_KEYBOARD ||
734			interface->desc.bInterfaceProtocol == USB_INTERFACE_PROTOCOL_MOUSE)
735				quirks |= HID_QUIRK_NOGET;
736	}
737
738	if (quirks & HID_QUIRK_IGNORE)
739		return NULL;
740
741	if ((quirks & HID_QUIRK_IGNORE_MOUSE) &&
742		(interface->desc.bInterfaceProtocol == USB_INTERFACE_PROTOCOL_MOUSE))
743			return NULL;
744
745
746	if (usb_get_extra_descriptor(interface, HID_DT_HID, &hdesc) &&
747	    (!interface->desc.bNumEndpoints ||
748	     usb_get_extra_descriptor(&interface->endpoint[0], HID_DT_HID, &hdesc))) {
749		dbg("class descriptor not present\n");
750		return NULL;
751	}
752
753	for (n = 0; n < hdesc->bNumDescriptors; n++)
754		if (hdesc->desc[n].bDescriptorType == HID_DT_REPORT)
755			rsize = le16_to_cpu(hdesc->desc[n].wDescriptorLength);
756
757	if (!rsize || rsize > HID_MAX_DESCRIPTOR_SIZE) {
758		dbg("weird size of report descriptor (%u)", rsize);
759		return NULL;
760	}
761
762	if (!(rdesc = kmalloc(rsize, GFP_KERNEL))) {
763		dbg("couldn't allocate rdesc memory");
764		return NULL;
765	}
766
767	hid_set_idle(dev, interface->desc.bInterfaceNumber, 0, 0);
768
769	if ((n = hid_get_class_descriptor(dev, interface->desc.bInterfaceNumber, HID_DT_REPORT, rdesc, rsize)) < 0) {
770		dbg("reading report descriptor failed");
771		kfree(rdesc);
772		return NULL;
773	}
774
775	if ((quirks & HID_QUIRK_CYMOTION))
776		hid_fixup_cymotion_descriptor(rdesc, rsize);
777
778	if (quirks & HID_QUIRK_LOGITECH_DESCRIPTOR)
779		hid_fixup_logitech_descriptor(rdesc, rsize);
780
781	if (quirks & HID_QUIRK_SWAPPED_MIN_MAX)
782		hid_fixup_cypress_descriptor(rdesc, rsize);
783
784#ifdef CONFIG_HID_DEBUG
785	printk(KERN_DEBUG __FILE__ ": report descriptor (size %u, read %d) = ", rsize, n);
786	for (n = 0; n < rsize; n++)
787		printk(" %02x", (unsigned char) rdesc[n]);
788	printk("\n");
789#endif
790
791	if (!(hid = hid_parse_report(rdesc, n))) {
792		dbg("parsing report descriptor failed");
793		kfree(rdesc);
794		return NULL;
795	}
796
797	kfree(rdesc);
798	hid->quirks = quirks;
799
800	if (!(usbhid = kzalloc(sizeof(struct usbhid_device), GFP_KERNEL)))
801		goto fail;
802
803	hid->driver_data = usbhid;
804	usbhid->hid = hid;
805
806	usbhid->bufsize = HID_MIN_BUFFER_SIZE;
807	hid_find_max_report(hid, HID_INPUT_REPORT, &usbhid->bufsize);
808	hid_find_max_report(hid, HID_OUTPUT_REPORT, &usbhid->bufsize);
809	hid_find_max_report(hid, HID_FEATURE_REPORT, &usbhid->bufsize);
810
811	if (usbhid->bufsize > HID_MAX_BUFFER_SIZE)
812		usbhid->bufsize = HID_MAX_BUFFER_SIZE;
813
814	hid_find_max_report(hid, HID_INPUT_REPORT, &insize);
815
816	if (insize > HID_MAX_BUFFER_SIZE)
817		insize = HID_MAX_BUFFER_SIZE;
818
819	if (hid_alloc_buffers(dev, hid)) {
820		hid_free_buffers(dev, hid);
821		goto fail;
822	}
823
824	for (n = 0; n < interface->desc.bNumEndpoints; n++) {
825
826		struct usb_endpoint_descriptor *endpoint;
827		int pipe;
828		int interval;
829
830		endpoint = &interface->endpoint[n].desc;
831		if ((endpoint->bmAttributes & 3) != 3)		/* Not an interrupt endpoint */
832			continue;
833
834		interval = endpoint->bInterval;
835
836		/* Change the polling interval of mice. */
837		if (hid->collection->usage == HID_GD_MOUSE && hid_mousepoll_interval > 0)
838			interval = hid_mousepoll_interval;
839
840		if (usb_endpoint_dir_in(endpoint)) {
841			if (usbhid->urbin)
842				continue;
843			if (!(usbhid->urbin = usb_alloc_urb(0, GFP_KERNEL)))
844				goto fail;
845			pipe = usb_rcvintpipe(dev, endpoint->bEndpointAddress);
846			usb_fill_int_urb(usbhid->urbin, dev, pipe, usbhid->inbuf, insize,
847					 hid_irq_in, hid, interval);
848			usbhid->urbin->transfer_dma = usbhid->inbuf_dma;
849			usbhid->urbin->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
850		} else {
851			if (usbhid->urbout)
852				continue;
853			if (!(usbhid->urbout = usb_alloc_urb(0, GFP_KERNEL)))
854				goto fail;
855			pipe = usb_sndintpipe(dev, endpoint->bEndpointAddress);
856			usb_fill_int_urb(usbhid->urbout, dev, pipe, usbhid->outbuf, 0,
857					 hid_irq_out, hid, interval);
858			usbhid->urbout->transfer_dma = usbhid->outbuf_dma;
859			usbhid->urbout->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
860		}
861	}
862
863	if (!usbhid->urbin) {
864		err("couldn't find an input interrupt endpoint");
865		goto fail;
866	}
867
868	init_waitqueue_head(&hid->wait);
869
870	INIT_WORK(&usbhid->reset_work, hid_reset);
871	setup_timer(&usbhid->io_retry, hid_retry_timeout, (unsigned long) hid);
872
873	spin_lock_init(&usbhid->inlock);
874	spin_lock_init(&usbhid->outlock);
875	spin_lock_init(&usbhid->ctrllock);
876
877	hid->version = le16_to_cpu(hdesc->bcdHID);
878	hid->country = hdesc->bCountryCode;
879	hid->dev = &intf->dev;
880	usbhid->intf = intf;
881	usbhid->ifnum = interface->desc.bInterfaceNumber;
882
883	hid->name[0] = 0;
884
885	if (dev->manufacturer)
886		strlcpy(hid->name, dev->manufacturer, sizeof(hid->name));
887
888	if (dev->product) {
889		if (dev->manufacturer)
890			strlcat(hid->name, " ", sizeof(hid->name));
891		strlcat(hid->name, dev->product, sizeof(hid->name));
892	}
893
894	if (!strlen(hid->name))
895		snprintf(hid->name, sizeof(hid->name), "HID %04x:%04x",
896			 le16_to_cpu(dev->descriptor.idVendor),
897			 le16_to_cpu(dev->descriptor.idProduct));
898
899	hid->bus = BUS_USB;
900	hid->vendor = le16_to_cpu(dev->descriptor.idVendor);
901	hid->product = le16_to_cpu(dev->descriptor.idProduct);
902
903	usb_make_path(dev, hid->phys, sizeof(hid->phys));
904	strlcat(hid->phys, "/input", sizeof(hid->phys));
905	len = strlen(hid->phys);
906	if (len < sizeof(hid->phys) - 1)
907		snprintf(hid->phys + len, sizeof(hid->phys) - len,
908			 "%d", intf->altsetting[0].desc.bInterfaceNumber);
909
910	if (usb_string(dev, dev->descriptor.iSerialNumber, hid->uniq, 64) <= 0)
911		hid->uniq[0] = 0;
912
913	usbhid->urbctrl = usb_alloc_urb(0, GFP_KERNEL);
914	if (!usbhid->urbctrl)
915		goto fail;
916
917	usb_fill_control_urb(usbhid->urbctrl, dev, 0, (void *) usbhid->cr,
918			     usbhid->ctrlbuf, 1, hid_ctrl, hid);
919	usbhid->urbctrl->setup_dma = usbhid->cr_dma;
920	usbhid->urbctrl->transfer_dma = usbhid->ctrlbuf_dma;
921	usbhid->urbctrl->transfer_flags |= (URB_NO_TRANSFER_DMA_MAP | URB_NO_SETUP_DMA_MAP);
922	hid->hidinput_input_event = usb_hidinput_input_event;
923	hid->hid_open = usbhid_open;
924	hid->hid_close = usbhid_close;
925#ifdef CONFIG_USB_HIDDEV
926	hid->hiddev_hid_event = hiddev_hid_event;
927	hid->hiddev_report_event = hiddev_report_event;
928#endif
929	return hid;
930
931fail:
932	usb_free_urb(usbhid->urbin);
933	usb_free_urb(usbhid->urbout);
934	usb_free_urb(usbhid->urbctrl);
935	hid_free_buffers(dev, hid);
936	hid_free_device(hid);
937
938	return NULL;
939}
940
941static void hid_disconnect(struct usb_interface *intf)
942{
943	struct hid_device *hid = usb_get_intfdata (intf);
944	struct usbhid_device *usbhid;
945
946	if (!hid)
947		return;
948
949	usbhid = hid->driver_data;
950
951	spin_lock_irq(&usbhid->inlock);	/* Sync with error handler */
952	usb_set_intfdata(intf, NULL);
953	spin_unlock_irq(&usbhid->inlock);
954	usb_kill_urb(usbhid->urbin);
955	usb_kill_urb(usbhid->urbout);
956	usb_kill_urb(usbhid->urbctrl);
957
958	del_timer_sync(&usbhid->io_retry);
959	flush_scheduled_work();
960
961	if (hid->claimed & HID_CLAIMED_INPUT)
962		hidinput_disconnect(hid);
963	if (hid->claimed & HID_CLAIMED_HIDDEV)
964		hiddev_disconnect(hid);
965
966	usb_free_urb(usbhid->urbin);
967	usb_free_urb(usbhid->urbctrl);
968	usb_free_urb(usbhid->urbout);
969
970	hid_free_buffers(hid_to_usb_dev(hid), hid);
971	hid_free_device(hid);
972}
973
974static int hid_probe(struct usb_interface *intf, const struct usb_device_id *id)
975{
976	struct hid_device *hid;
977	char path[64];
978	int i;
979	char *c;
980
981	dbg("HID probe called for ifnum %d",
982			intf->altsetting->desc.bInterfaceNumber);
983
984	if (!(hid = usb_hid_configure(intf)))
985		return -ENODEV;
986
987	usbhid_init_reports(hid);
988	hid_dump_device(hid);
989	if (hid->quirks & HID_QUIRK_RESET_LEDS)
990		usbhid_set_leds(hid);
991
992	if (!hidinput_connect(hid))
993		hid->claimed |= HID_CLAIMED_INPUT;
994	if (!hiddev_connect(hid))
995		hid->claimed |= HID_CLAIMED_HIDDEV;
996
997	usb_set_intfdata(intf, hid);
998
999	if (!hid->claimed) {
1000		printk ("HID device not claimed by input or hiddev\n");
1001		hid_disconnect(intf);
1002		return -ENODEV;
1003	}
1004
1005	if ((hid->claimed & HID_CLAIMED_INPUT))
1006		hid_ff_init(hid);
1007
1008	if (hid->quirks & HID_QUIRK_SONY_PS3_CONTROLLER)
1009		hid_fixup_sony_ps3_controller(interface_to_usbdev(intf),
1010			intf->cur_altsetting->desc.bInterfaceNumber);
1011
1012	printk(KERN_INFO);
1013
1014	if (hid->claimed & HID_CLAIMED_INPUT)
1015		printk("input");
1016	if (hid->claimed == (HID_CLAIMED_INPUT | HID_CLAIMED_HIDDEV))
1017		printk(",");
1018	if (hid->claimed & HID_CLAIMED_HIDDEV)
1019		printk("hiddev%d", hid->minor);
1020
1021	c = "Device";
1022	for (i = 0; i < hid->maxcollection; i++) {
1023		if (hid->collection[i].type == HID_COLLECTION_APPLICATION &&
1024		    (hid->collection[i].usage & HID_USAGE_PAGE) == HID_UP_GENDESK &&
1025		    (hid->collection[i].usage & 0xffff) < ARRAY_SIZE(hid_types)) {
1026			c = hid_types[hid->collection[i].usage & 0xffff];
1027			break;
1028		}
1029	}
1030
1031	usb_make_path(interface_to_usbdev(intf), path, 63);
1032
1033	printk(": USB HID v%x.%02x %s [%s] on %s\n",
1034		hid->version >> 8, hid->version & 0xff, c, hid->name, path);
1035
1036	return 0;
1037}
1038
1039static int hid_suspend(struct usb_interface *intf, pm_message_t message)
1040{
1041	struct hid_device *hid = usb_get_intfdata (intf);
1042	struct usbhid_device *usbhid = hid->driver_data;
1043
1044	spin_lock_irq(&usbhid->inlock);	/* Sync with error handler */
1045	set_bit(HID_SUSPENDED, &usbhid->iofl);
1046	spin_unlock_irq(&usbhid->inlock);
1047	del_timer(&usbhid->io_retry);
1048	usb_kill_urb(usbhid->urbin);
1049	dev_dbg(&intf->dev, "suspend\n");
1050	return 0;
1051}
1052
1053static int hid_resume(struct usb_interface *intf)
1054{
1055	struct hid_device *hid = usb_get_intfdata (intf);
1056	struct usbhid_device *usbhid = hid->driver_data;
1057	int status;
1058
1059	clear_bit(HID_SUSPENDED, &usbhid->iofl);
1060	usbhid->retry_delay = 0;
1061	status = hid_start_in(hid);
1062	dev_dbg(&intf->dev, "resume status %d\n", status);
1063	return status;
1064}
1065
1066/* Treat USB reset pretty much the same as suspend/resume */
1067static void hid_pre_reset(struct usb_interface *intf)
1068{
1069	hid_suspend(intf, PMSG_ON);
1070}
1071
1072static void hid_post_reset(struct usb_interface *intf)
1073{
1074	struct usb_device *dev = interface_to_usbdev (intf);
1075
1076	hid_set_idle(dev, intf->cur_altsetting->desc.bInterfaceNumber, 0, 0);
1077
1078	hid_resume(intf);
1079}
1080
1081static struct usb_device_id hid_usb_ids [] = {
1082	{ .match_flags = USB_DEVICE_ID_MATCH_INT_CLASS,
1083		.bInterfaceClass = USB_INTERFACE_CLASS_HID },
1084	{ }						/* Terminating entry */
1085};
1086
1087MODULE_DEVICE_TABLE (usb, hid_usb_ids);
1088
1089static struct usb_driver hid_driver = {
1090	.name =		"usbhid",
1091	.probe =	hid_probe,
1092	.disconnect =	hid_disconnect,
1093	.suspend =	hid_suspend,
1094	.resume =	hid_resume,
1095	.pre_reset =	hid_pre_reset,
1096	.post_reset =	hid_post_reset,
1097	.id_table =	hid_usb_ids,
1098};
1099
1100static int __init hid_init(void)
1101{
1102	int retval;
1103	retval = usbhid_quirks_init(quirks_param);
1104	if (retval)
1105		goto usbhid_quirks_init_fail;
1106	retval = hiddev_init();
1107	if (retval)
1108		goto hiddev_init_fail;
1109	retval = usb_register(&hid_driver);
1110	if (retval)
1111		goto usb_register_fail;
1112	info(DRIVER_VERSION ":" DRIVER_DESC);
1113
1114	return 0;
1115usb_register_fail:
1116	hiddev_exit();
1117hiddev_init_fail:
1118	usbhid_quirks_exit();
1119usbhid_quirks_init_fail:
1120	return retval;
1121}
1122
1123static void __exit hid_exit(void)
1124{
1125	usb_deregister(&hid_driver);
1126	hiddev_exit();
1127	usbhid_quirks_exit();
1128}
1129
1130module_init(hid_init);
1131module_exit(hid_exit);
1132
1133MODULE_AUTHOR(DRIVER_AUTHOR);
1134MODULE_DESCRIPTION(DRIVER_DESC);
1135MODULE_LICENSE(DRIVER_LICENSE);
1136